CryptoWall ransomware had been missing for about two months, and it appears the resurgent malware has been updated to version 3.0, which comes with geolocation to deliver ransom messages.
In addition to this modification, security researchers also noticed that it is equipped with multiple addresses that lead to a decryption service located on the anonymous I2P network.
Traffic is routed through special proxy servers by I2P, which is a network that cannot be accessed like regular websites on the Internet.
I2P is another anonymous network, similar to Tor, where traffic is encrypted multiple times and routed through a series of proxies that hide the user's identity.
CryptoWall ransomware, also known as Crowti, is a ransomware that includes file encryption capabilities. Once executed on a computer, it begins encrypting the system's data.
Finally, it displays a ransom message to the victim, containing instructions on how to pay the money in order to receive the key to unlock the files. The fee is usually around $500, which must be paid within 168 hours, in Bitcoins.
Version 3.0 was discovered by French security researcher Kafeine, as well as Microsoft experts.
In a post, Kafeine states that communication with the command and control server is encoded with the RC4 encryption algorithm and uses the I2P protocol.
The researcher tested the new CryptoWall and noticed that the proxies did not work, and an error message was displayed as the malware tried to connect.
However, criminals are prepared and provide instructions on how to access an extra decryption service hidden in the Tor network.
According to Microsoft data, CryptoWall ransomware 3.0 has infected 288 unique machines in just two days, from January 11th to 12th.
